Check Sophos Firewall Advanced Firewall Settings safely

The Advanced Firewall Settings on Sophos Firewall are not a collection of harmless convenience options. Many values have a global effect on packet inspection, connection state, or timeouts. A change can therefore affect several firewall rules, VPNs, applications, and user paths at the same time.

The safe starting point is always read-only: show advanced-firewall displays the current state. A single setting is changed in a maintenance window only when a reproducible problem matches that parameter. The previous value, a control comparison, and the rollback must be documented before the set command is entered.

⚠️ Do not copy Advanced Firewall Settings from a tuning list. The documented defaults suit most environments. Global protection functions such as strict-policy or tcp-seq-checking must not be disabled speculatively, and timeouts must not be increased without measured application requirements.

Safe quick path

1. Record the exact symptom in Log Viewer, Packet Capture, and the affected application, including timestamp, source, destination, service, and direction.
2. Save the current state from the Device Console with show advanced-firewall.
3. Check whether a dedicated article already covers the parameter and whether the firewall rule, NAT, routing, MTU, or peer is the more likely cause.
4. Change only one global value and prepare the previous value as a ready-to-use rollback command.
5. Retest the affected flow and at least one unrelated control flow.
6. If the change does not clearly help or creates new symptoms, restore the documented initial value immediately.

A green connection or a single successful ping is not sufficient acceptance evidence. Depending on the change, the Rule ID, NAT Rule ID, TCP or UDP behavior, packet flow, application function, and reverse direction must also be correct. The procedure is described in Test a Sophos Firewall rule properly.

Read the state and understand the effect

The commands run in the Device Console, not in the Advanced Shell. After the SSH login, select 4. Device Console from the console menu. Access, host key verification, and narrow management access are covered in Sophos Firewall CLI troubleshooting.

show advanced-firewall

The output is a baseline, not a health check. A value can be displayed correctly and still be unsuitable for an application. Conversely, a value that differs from the default does not by itself prove a fault. What matters is when and why it was set and which measurable behavior it changes.

Global rather than per firewall rule

set advanced-firewall does not change one firewall rule. The parameters sit below or alongside normal policy evaluation. A globally increased UDP timeout therefore does not apply only to one VoIP rule. Likewise, tcp-seq-checking off does not limit the relaxation to one server.

Four items are documented before every change: the current value, the specific test flow, the expected effect, and the restore command. Without a narrow positive and negative test, the change is not ready for production.

Secure access and packet inspection

Block WebAdmin globally from WAN

restrict-admin-console-wan-access is a coarse global protection switch. With enable, WebAdmin is disabled for all WAN sources; Sophos documents enable as the default. The seemingly reversed wording matters: enable activates the restriction, not WAN access.

set advanced-firewall restrict-admin-console-wan-access enable

This protection is not simply opened with disable for one fixed administration source. First check whether a management VPN, Sophos Central, or a narrow Local Service ACL Exception is sufficient. The secure design is covered in Device Access and Local Service ACL.

ICMP, fragments, and IPv6 extensions

icmp-error-message controls ICMP error messages such as Network, Host, or Port Unreachable. The documented default is allow. A blanket deny can hide important error and Path MTU signals and make diagnosis harder.

fragmented-traffic allows or denies fragmented IP traffic; the default is allow. Fragmentation is not automatically an attack. Before a global deny, clarify MTU, PMTUD, VPN overhead, protocol, and the actual packet flow.

ipv6-unknown-extension-header handles IPv6 packets with unknown extension headers. Sophos documents deny as the default. Relaxing it requires a proven legitimate use case and an IPv6 packet capture, not merely a general reachability problem.

ipv6-ready-logo-compliance is off by default. With on, the firewall adapts its behavior for the formal IPv6 Ready Logo test program. This is neither the switch that enables IPv6 nor a general IPv6 workaround. The basics and acceptance of a production IPv6 path are covered in IPv6 support on Sophos Firewall.

strict-policy is on by default and drops certain unusual packets and IP-based attacks. The narrowly scoped procedure for the specific Invalid TCP reserved bit error is available in Check Accurate ECN and Strict Policy. Without this or equivalent evidence, the function remains enabled.

ftpbounce-prevention protects against FTP bounce attacks in which a PORT command contains a foreign third-party address. The parameter distinguishes inspection on the control or data connection; Sophos documents control as the default. A change to data is assessed only with a clear FTP compatibility case, a narrow rule, and a documented file-transfer test.

Check TCP behavior selectively

Sophos enables Selective Acknowledgement with tcp-selective-acknowledgement on by default. SACK lets the receiver report specific missing segments so that the whole TCP window does not need to be retransmitted. tcp-window-scaling on is also the default and permits windows larger than 64 KB. Both functions help especially on paths with high bandwidth or latency; disabling them is not a general stability fix.

tcp-frto and tcp-timestamp are off by default. F-RTO improves sender-side recovery after retransmission timeouts, especially when loss is caused by random radio interference rather than congestion. TCP timestamps enable more precise round-trip measurement. Enable either option only with a reproducible TCP test and control comparison, not together as generic performance tuning.

Sequence checking and midstream connections

With tcp-seq-checking on, the firewall checks by default whether sequence and acknowledgement numbers match the known TCP state. Some non-RFC-compliant applications can send invalid sequence numbers. However, off relaxes this check globally. Packet Capture, the drop reason, and the peer must support the suspicion first.

midstream-connection-pickup is off by default. With on, the firewall can pick up TCP connections that are already running but not yet tracked. Sophos cites introducing a bridge into a live network or special asymmetric designs as examples. The option replaces neither symmetric routing nor correct firewall rules and must not remain enabled after a migration without a reason.

Idle timeout for established TCP connections

tcp-est-idle-timeout determines how long an established but inactive TCP connection remains in state. The permitted range is 2700 to 432000 seconds.

A longer lifetime can help an application with genuinely long idle periods, but it also increases the number of stale states and does not resolve timeouts on the server, load balancer, NAT gateway, or client. Compare both endpoints, keepalives, and the time of failure before making a change. Explicitly restore the previous numeric value if the test shows no clear benefit.

Size UDP states for the application

UDP has no TCP handshake. Sophos therefore distinguishes two global time values. udp-timeout applies to UDP connections that have not yet been recognized as a stream. udp-timeout-stream applies once both endpoints have sent traffic over the same port between network segments. Both values support 30 to 3600 seconds.

set advanced-firewall udp-timeout <30-3600>
set advanced-firewall udp-timeout-stream <30-3600>

A high value is not automatically better. It keeps states longer but can also create stale sessions and more state-table entries. For VoIP, SIP, or RTP, inspect signaling, media ports, both directions, and the exact time of the audio failure together. The dedicated procedure is available in Optimize and check VoIP on Sophos Firewall.

Do not confuse bypass and system traffic NAT

Bypass the stateful firewall only for a proven special case

bypass-stateful-firewall-config exempts hosts or networks from the normal stateful firewall path. Sophos requires entries in both directions for a complete outbound connection path. The number of possible entries is not limited, but this is exactly why an old bypass list can quickly become unclear and security-critical.

A bypass rule is not a quick allow rule or a normal performance switch. It can bypass policy evaluation, logging, and security functions. Syntax, bidirectional testing, and rollback are covered in Use a Sophos Firewall bypass rule safely.

NAT for traffic generated by the firewall

sys-traffic-nat changes the source address of traffic generated by the firewall itself for a specific destination. destination and snatip are mandatory; interface and netmask can narrow the entry further when needed.

This is not a substitute for a normal SNAT or MASQ rule for forwarded client traffic. It also does not create a route. Typical special cases and safe removal are described separately in Interface alias for system traffic, SD-WAN routing for reply packets and system traffic, and IPsec route and system traffic.

Accept and roll back a change

Save show advanced-firewall before and after the change. Then repeat exactly the same controlled test with the same source, destination, service, direction, and, where possible, comparable load. The result supports the change only if the expected symptom disappears and an unrelated control flow remains unchanged.

The rollback uses the same parameter with the previously documented value. For a numeric value, restore the actual saved initial value rather than an assumed default. For on, off, allow, deny, enable, or disable, restore the state read from the baseline as well.

If the change does not help

• No difference in the affected flow: Restore the initial value and check the rule, NAT, route, peer, or application.
• Only new sessions behave differently: End old connections in a controlled manner or use a fresh test flow; existing states can distort the assessment.
• Other applications become unstable: Roll back immediately. This demonstrates the global effect, not a need for additional Advanced Firewall changes.
• HA cluster: Document the state and test on the processing node and repeat the check with a new connection after a planned failover. Do not assume uninterrupted transfer of a changed connection state.

Operational checklist

• Initial output from show advanced-firewall, time, build, and responsible person documented.
• One parameter selected with a specific problem and expected effect.
• Global security and performance effect assessed.
• Rollback prepared with the actual previous value.
• Affected flow, reverse direction, and unrelated control flow tested.
• Bypass and sys-traffic-nat entries inventoried separately.
• show advanced-firewall saved again after the test and unnecessary changes reverted.

FAQ